Metadata

ID: bash-security/avoid-eval-on-list-expansions

Language: Bash

Severity: Error

Category: Security

CWE: 78

Description

List expansions expand to multiple words—chiefly $@ (positional parameters) and ${name[@]} (array elements). Feeding those into eval runs another round of shell parsing on the expanded words, so quoting and word boundaries can shift in dangerous ways and open the door to command injection (CWE-78).

Prefer fixing the data flow, calling commands without eval, or restructuring so each argument is handled safely without another round of shell parsing.

Non-Compliant Code Examples

#!/bin/bash
eval "$@"
eval "${files[@]}"
eval $@ foo
eval ${arr[@]}

Compliant Code Examples

#!/bin/bash
eval "echo hello"
eval "$foo"
eval "${arr[0]}"
printf '%s\n' "$@"
cmd "$@"

Seamless integrations. Try Datadog Code Security

Datadog Code Security